Azure Service Management API authentication using Azure Active Directory Oauth

Question

I'd like to authenticate to the Azure Service Management API using Azure AD through curl.

I set up an application within my default directory. In this free trial subcription that's the only directory I have.

When I target the oauth token endpoint I receive a JWT.

curl --data "grant_type=client_credentials&client_id=<my_client_id>&client_secret=<my_encoded_secret>&resource=https%3A%2F%2Fmanagement.core.windows.net" https://login.windows.net/<my_tenant_id>/oauth2/token

But when I use that token to list my subscription details I receive an error:

curl -H "x-ms-version: 2014-06-01" \
     -H "Authorization: Bearer <my_token>" \
     https://management.core.windows.net/<my_subscription_id>/

    <Error xmlns="http://schemas.microsoft.com/windowsazure" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
      <Code>ForbiddenError</Code>
      <Message>The server failed to authenticate the request. Verify that the certificate is valid and is associated with this subscription.</Message>
    </Error>

I have granted permissions to the Service Management API for the application as "Delegated permissions", because "Application permissions" are not available.

What am I missing?

Answer 1

This isn't possible due to the Application Permissions: 0 setting for the Service Management API. The client_credentials grant type uses credentials from the application (client_id and client_secret), and since the application does not have permissions for this API the call fails.

Since the Service Management API will not allow application permissions of any kind, we must use the authorization_code grant type or some other method to obtain a user token.

Answer 2

It turns out the Azure Service Management API permissions cannot be configured through the Azure Portal API.

The full solition is here:

https://blog.jongallant.com/2021/02/azure-rest-apis-postman-2021/

The solution lies in using the Azure CLI to create a service principal that already has the rights assigned.

az ad sp create-for-rbac

You can go directly to https://shell.azure.com/ and execute the command.

Be sure to save the resulting credential data securely.